a command line packet analyzer

learn more… | top users | synonyms

8
votes
1answer
5k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
4
votes
1answer
750 views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
8
votes
3answers
7k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
1
vote
3answers
811 views

using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Does it makes a more detailed output if I use tcpdump -vvv -w FILENAME vs. if I use: tcpdump -w FILENAME or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?